At least a few people on this thread are more used to examining and analyzing this point than I am; but, if I'm not mistaken, at least some of that de-aggregation in Route Views, RIS, or other route-collectors may result from networks giving feeds to the collectors that are either internal iBGP feeds or otherwise don't represent what they typically send to "the outside world".
Yes. This happens all the time. Sometimes maliciously , sometimes not. A particular ASN used to send me some /24s that they didn't send to the DFZ or anyone else for a specific business case. They also didn't announce a covering aggregate for that either. At the time , we were sending our IBGP view to a route-collector. At some point that ASN (rightly) started to announce the covering aggregate to the DFZ, and started calling me because whoever they were using for hijack monitoring started complaining I was hijacking these /24s. On Sun, Aug 31, 2025 at 11:27 AM Tony Tauber via NANOG < nanog@lists.nanog.org> wrote:
On the point of:
lots of disaggregation on Route Views that isn't present in our RIB
At least a few people on this thread are more used to examining and analyzing this point than I am; but, if I'm not mistaken, at least some of that de-aggregation in Route Views, RIS, or other route-collectors may result from networks giving feeds to the collectors that are either internal iBGP feeds or otherwise don't represent what they typically send to "the outside world".
Not only is it unlikely that one may ever see convergence to just one type of feed to collectors from all the participants, but even if one did, it's not straightforward whether the view that "a customer" or a non-transit partner might receive is preferable.
See some research about "Global BGP Attacks That Evade Route Monitoring <https://ripe89.ripe.net/archives/video/1540/>" from 2024, for instance.
Cheers, Tony
On Sat, Aug 30, 2025 at 3:03 AM Philip Smith via NANOG < nanog@lists.nanog.org> wrote:
Brian Knight via NANOG wrote on 30/8/2025 10:00:
I see the cause of the discrepancy now. Bumped up our RIB against Route Views, and I see lots of disaggregation on Route Views that isn't present in our RIB. Had no idea we were being shielded from *that* many /24's.
Oh and if you take a general wander around all the collectors in various parts of the world, and compare the full views we get there versus what you see. Or what I see in my weekly Routing Table Report I send here (and a few NOG lists), which is pretty much what the RouteViews collector hosted for us by the WIDE project at DIXIE gets to see (my Routing Table Report view is courtesy of APNIC's peering there).
Many apologies for the Friday night stupidity :(
As others have said, this global routing table is a most fascinating thing, everywhere you look at it. :-)
philip -->
-Brian
On 2025-08-29 16:49, Brian Knight via NANOG wrote:
On 2025-08-29 15:15, Tom Beecher via NANOG wrote:
Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if memory serves. So this already happened months ago.
I'm confused by that.
I show 990450 prefixes in my FIB, 990478 in RIB.
Potaroo shows 1022758 prefixes in FIB for today.
Why would there be a discrepancy of over 32k prefixes?
We're blocking exactly 0 prefixes from our three upstreams.
I would understand a hand-waving explanation of "this is the Internet, it's always being updated, and everyone has a different view of it" if the discrepancy were 10^2 or even 10^3. But over 10^5? That's a bit like the three top ASNs for route count just disappeared from the Internet.
-Brian
NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/SRSNDFOZ...